Ark directory traversal issue (CVE-2011-2725)

[Scott Kitterman]

From the upstream KDE packager's mail list:

In the ark repository (git://anongit.kde.org/ark) there are now patches
to fix a path traversal issue. The CVE ID for this is CVE-2011-2725.

There is no embargo, although I likely won't get a security advisory up
for a day or two. Due to a coordination mishap between us and the
reporter (only discovered earlier today), the details were posted on a
full disclosure list quite some time ago, so please apply these as soon
as possible.

4.5: http://commits.kde.org/ark/6f6c0b1
4.6: http://commits.kde.org/ark/7cf0033
4.7: http://commits.kde.org/ark/ccb5448
master: http://commits.kde.org/ark/e88d227

[Scott Kitterman (kitterman)]

Making public since the fix is public and it was already published on full disclosure.

[Scott Kitterman (kitterman)]

Probably affects Lucid, but didn't check the code and upstream didn't provide a fix, so not marking confirmed there.

[Jamie Strandboge (jdstrand)]

Just to provide an update here, because of the Kubuntu point releases in -updates combined with a newer kde4libs in -security for lucid-natty, I had to do several no-change rebuilds in -security so that kdeutils is installable. Because oneiric does not have a newer kde4libs, I will be publishing two updates for it: one in -security and one on -updates.

[Jonathan Riddell (jr)]

Will be included in 4.7.3 packages in precise

[Launchpad Janitor (janitor)]

This bug was fixed in the package kdeutils - 4:4.7.2-0ubuntu1.1

---------------
kdeutils (4:4.7.2-0ubuntu1.1) oneiric-proposed; urgency=low

  * SECURITY UPDATE: fix directory traversal in Ark
    - debian/patches/CVE-2011-2725.patch: filter out '../' when previewing
      archives
    - CVE-2011-2725
    - LP: #878619
 -- Jamie Strandboge <email address hidden> Sun, 30 Oct 2011 16:09:14 -0400

[Launchpad Janitor (janitor)]

This bug was fixed in the package kdeutils - 4:4.6.5-0ubuntu1.2

---------------
kdeutils (4:4.6.5-0ubuntu1.2) natty-security; urgency=low

  * SECURITY UPDATE: fix directory traversal in Ark
    - debian/patches/CVE-2011-2725.patch: filter out '../' when previewing
      archives
    - CVE-2011-2725
    - LP: #878619
 -- Jamie Strandboge <email address hidden> Sun, 30 Oct 2011 16:16:10 -0400

[Launchpad Janitor (janitor)]

This bug was fixed in the package kdeutils - 4:4.5.5-0ubuntu2.2

---------------
kdeutils (4:4.5.5-0ubuntu2.2) maverick-security; urgency=low

  * SECURITY UPDATE: fix directory traversal in Ark
    - debian/patches/CVE-2011-2725.patch: filter out '../' when previewing
      archives
    - CVE-2011-2725
    - LP: #878619
 -- Jamie Strandboge <email address hidden> Tue, 08 Nov 2011 16:25:32 -0600

[Launchpad Janitor (janitor)]

This bug was fixed in the package kdeutils - 4:4.4.5-0ubuntu1.2

---------------
kdeutils (4:4.4.5-0ubuntu1.2) lucid-security; urgency=low

  * SECURITY UPDATE: fix directory traversal in Ark
    - debian/patches/CVE-2011-2725.patch: filter out '../' when previewing
      archives
    - CVE-2011-2725
    - LP: #878619
 -- Jamie Strandboge <email address hidden> Tue, 08 Nov 2011 16:13:53 -0600

[Jamie Strandboge (jdstrand)]

I have unassigned myself from the Precise task because the version in precise now FTBFS. Since Jonathon mentioned 4.7.3 will fix this, for now we can wait on it.

[Jamie Strandboge (jdstrand)]

Precise now has 4:4.7.3-0ubuntu1.